CVE-2005-3388
MEDIUM
4.3
CVSS 2.0
Description
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."
Affected products and versions
- PHP versions 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5
References
- itrc.hp.com http://itrc.hp.com/service/cki/docDisplay.do?docId=c00786522
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2006-0549.html
- secunia.com http://secunia.com/advisories/17371 Patch, Vendor Advisory
- secunia.com http://secunia.com/advisories/17490
- secunia.com http://secunia.com/advisories/17510
- secunia.com http://secunia.com/advisories/17531
- secunia.com http://secunia.com/advisories/17557
- secunia.com http://secunia.com/advisories/17559
- secunia.com http://secunia.com/advisories/18198
- secunia.com http://secunia.com/advisories/18669
- secunia.com http://secunia.com/advisories/21252
- secunia.com http://secunia.com/advisories/22691
- securityreason.com http://securityreason.com/securityalert/133
- securitytracker.com http://securitytracker.com/id?1015130
- support.avaya.com http://support.avaya.com/elmodocs2/security/ASA-2006-037.htm
- www.fedoralegacy.org http://www.fedoralegacy.org/updates/FC2/2005-11-28-FLSA_2005_166943__Updated_php_packages_fix_security_issues.html
- www.gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200511-08.xml
- www.hardened-php.net http://www.hardened-php.net/advisory_182005.77.html Vendor Advisory
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2005:213
- www.novell.com http://www.novell.com/linux/security/advisories/2005_27_sr.html
- www.openpkg.org http://www.openpkg.org/security/OpenPKG-SA-2005.027-php.html
- www.php.net http://www.php.net/release_4_4_1.php Patch
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2005-831.html
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2005-838.html
- www.securityfocus.com http://www.securityfocus.com/archive/1/415292
- www.securityfocus.com http://www.securityfocus.com/bid/15248 Patch
- www.turbolinux.com http://www.turbolinux.com/security/2006/TLSA-2006-38.txt
- www.vupen.com http://www.vupen.com/english/advisories/2005/2254
- www.vupen.com http://www.vupen.com/english/advisories/2006/4320
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PIRZJHM6UDNWNHZ3PCMEZ2YUK3CWY2UE/
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10542
- www.ubuntu.com https://www.ubuntu.com/usn/usn-232-1/
- nvd.nist.gov Official NVD record